diff --git a/.custodian-brief.md b/.custodian-brief.md
index 78d1e0d..de13ba0 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — reuse-surface
 
 **Domain:** infotech  
-**Last synced:** 2026-10-16 19:10 UTC  
+**Last synced:** 2026-10-20 22:55 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -12,6 +12,7 @@ Progress: 2/3 done  |  workplan_id: `23c7bcf5-5f5d-524f-a06e-be5247ae1a98`
 
 **Open tasks:**
 - ! Review, publish and verify deployed consumer  `789bb918`
+  *(wait: Execution of approved credential provisioning and platform/apps image rollout)*
 
 ---
 ## MCP Orientation (when available)
diff --git a/workplans/REUSE-WP-0025-private-source-reader-boundary.md b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
index 1a19065..97d2e66 100644
--- a/workplans/REUSE-WP-0025-private-source-reader-boundary.md
+++ b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
@@ -58,11 +58,9 @@ not live authenticated fetch receipts.
 id: REUSE-WP-0025-T03
 status: wait
 priority: high
-needs_human: true
-intervention_note: "Approved (81c8535a): create reuse-surface-reader Forgejo bot + read:repository PAT into OpenBao/ESO; platform/apps rollout"
-blocking_reason: "Execution of approved credential provisioning and platform/apps image rollout"
+blocked_on: message-from:railiance-apps
+blocking_reason: "Approved rollout requested from railiance-apps (msg f8f142bc); prerequisite: operator creates reuse-surface-reader bot + PAT in OpenBao"
 state_hub_task_id: "789bb918-4848-5bdf-bfd4-8ee42877addb"
-decision_id: "81c8535a-e0c3-4cb6-9412-bf5ce7696b3d"
 ```
 
 Owner review and exact credential/rollout disposition remain pending. Platform/apps
@@ -82,3 +80,5 @@ URLs, and (3) the platform/apps rollout as described above. Remaining: create th
 bot user and token (human/operator — agents do not handle the secret value), roll
 out, run the helper, hand over the receipt. Follow-up: define how allowlist pins
 are refreshed and re-approved when the source repos update their metadata.
+Rollout requested from railiance-apps via hub message f8f142bc; T03 now waits
+on that reply (image digest, Helm revision, sanitized helper receipt).